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(51) IntCl. 7 
GO 6F 



9/06 
12/14 



5 5 0 
3 10 



F I 

GO 6 F 



9/06 
12/14 



r-73-r (#%) 
550Z 5B017 
31 OH 5B076 



* * (£ 33 R) 



(20 

(86) (22)fflSH 
(85)«9?53iWB 
(86) 

(87) HBR^BS*^ 
(87)BB5&BIB 

(31) «5fctfcfe31|#*| 

(32) «5fe0 

(33) «Bte»*®H 
(81)Jt^S 
DE, DK, ES, 
T, LU, MC, N 



4$H2000-508048( P2000- 508048) 
¥js£10¥ 8 £25 B (1998. 8. 25) 
¥J£12*F 2 ft 28 B (2000. 2. 28) 
PCT/US 9 8/17553 
W09 9/1 0 7 9 5 
¥*fcl 1¥ 3 ft 4 B (1999. 3. 4) 
0 8/9 1 9. 844 
¥^9^8 8280(1997.8.28) 
*H (US) 

EP (AT, BE, CH. CY, 
F I, FR, GB, GR, I E, I 
L, PT, SE), JP 



(71) tH®A T'fi/DV^h 3— #W^3> 

MICROSOFT CORPORATI 
ON 

7^U*-&*B 7-»h>*N 98052- 
6399 7> Y-f^PV7 

(72) 56M« 

7^U*-&*@ U'»b>m 98059 

77- Xh XHJ — h 4902 
(74)ftSA #S± «W & W9«) 



(54) [589J©£ffc] ©ST€f^V^ffnJt63— HlrM-rS-fe^a-U^-flRjJi 



(57) i&mi 

>X)WHfg;* ftS^*® D ST 6 ttfc* U 

mm (-y->H#y^x) wicd— nsn. ii-'fiio^^EU 

>:/n£f^A-f 7i- X (API) n— JWJ* * 
Xh">X^A©-fe+a.U-T-^©g^&B(5FJhL^*t6» §g 

frn— nattfex h*-^— 7^ >^->x^Atry^-bx 

^tl5. n— Hfc&lt-SI&WJ^tt. 3—)V\z£i 
P I a— /Mftftvcis— 7-4 >^->x5Sk-C^fr snsc 
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m 
J 

1> 



1 1* 
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[nmm i ] 

M£n&^:/n^A£iifT-r-5, 
umm 3 ] 

-TZ-ty hlzm&7 9'£XTZ>Z\t$:ftWlZi'?%. m mm i ^te«c©^„ 

[If 5 ] 
[»^« 6 ] 
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p > tf a. - ^ Hff RJtg^^ P - H £ Q^-T S 3 > tf - ^ M^SX 0 pJtgffili^ 

C»^« 7 ] 

TS^tlfc ft ^ $ tltSL V i y P 9 =? A £ Hfff -5 *£> <D X 5 1/ — $ £: , 

^-^i/— >y^x^A©-r x^&^zl— ;w^^ffl-r^>iii 

& 56 (Dim M £ n& l^D ^ ^ Art fc# A rJ# x. v 9 p — H h , 

h ^ * - a -c ifi^^ff -r & & o \z mfrwtmm £ n& ^ y n # ? a & ntf *r st 
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m^m i o ] 

i i ] 

h y * — ATE^ntTf ^ =t o \zmfrtifrmmz n& ^ y° o y ? a £^itf -r & 

12] 

— JMD-fcy F£rX h7t§, 
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^^^^^^^^ ^^^^^^^ 

nmm 1 3 ] 

y U y h K «k o T ^ ^ U 7 >? X^a£>f iJ D ST«~> tlfc ^tU IBB KfcJ&g£ n§ 

1 4 ] 

AP I 3-^7^1/7 HCcfcoTft^tl-gxh^ Zi > h □— ;i/^D L L (Cfe 
21 U 

C§t^3S 1 5 ] 

[mmm. 1 6 ] 
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maim 1 7 ] 

xz7 3-f^, /\° y * — v >t. £ [p]±-r * «fc 5 tc: ^ ^ u :/ □ y * Turnf <5 

, si^Si 6 lc tern© 7:/^ Mcwrs-fe^aU-TV £ffi#rf3#iiu 

[If 18] 

m&m 19] 

fc:Wx86VM£MbT, 
[fjf«|2 0] 

-kx #^£>fij 0 ^ t e> ntz * ^ u M^(-$ij^g $ n& ct 5 & ^ > ^ -r a ^ ^ u -t ^ 
& ap 1 3 - )v &m $ n -5 , 

£ £ £ W f § X t- y 7°& mftT Z> tc #> KWx86VM£ f Uffl f -5 n > t: - ^ HfT oJtg 
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[0 0 0 1 ] 

ff Wffl6 7° u 9 =? A e> © v X t- A fflfl £ HI M T & d £ it 3 . 
[0 0 0 2] 

-1>&— *v Vf^O+fcommL WWW (9— ;H*"7-f Ftfx:/ : World Wi 
de Web) GDifrftROH' >^^?V i^^DJUt. it*fc 

-^yXrAXH 3>fc:a. — ^->X^A<7)^-^^^iE-r^^&cc»$)^>yn^ 
[0 0 0 3] 

[0 0 0 4] 
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ActiveXn> h Java<DfcJP£2nfc^£®j®-r£3iff pJtgfcs- H 

<Dy*—&-C&Z>o ActiveX**, OLE (Object Linking and Embedding) &X£ 
COM (Component Object Model) ZimttlZ'?^ 9 U V 7 b%k<D 2 ~D<0&ffi<D 
mV0T*$>Z> o ActiveX^ ^ttlffl^ — *y h S^ffiTS H t^T^^> <h 
HiW-ht§ 0 0>J;Lfc£, ActiveXn>hn-;Hi, Web^tflf icfcoTg 

[0 0 0 5] 

ActiveXn> hn— ?v — HTf^nsrot, -^ti^te^l/ 

T!fcZ> 0 ActiveXn> ho-j^t, o^^M^x^n- 

>^'>XfA^OtM7^tXH, iSISiJ^-fe^iU^W^raSS^-r-S. Acti 

[0 0 0 6] 
[0 0 0 7] 



t 
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^xy^ ( H (sniff code) J ) tt, £ns©f&l|g£MiJt"5. ft 

(API) 3— ;Wi, *X hyXfAOt+a'Jf-fOiiSHllbW6, SI 

( r-tf>^ (thunks) j ) Tg&sn*. 3>hn-Mtt77 1 

^ff ^cap i □-Mf^e.ns n> hP-;i/«it>^tc^MU, api 

[0 0 0 8] 

fl8## lc ck o t $ n 3 „ 

[0 0 0 9] 
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^n>t°rL-^vXT-ATHff £ tl 5 3 £ £ te, ^H#lCl«^e»^Tffe^>5, * 

o 

[0010] 

Elite, *56W^II^Sn*iiSa^ti-^ll%©ffim^— 

mmmi%T*hmft2nz>o ftmstwmm-ci*. -T'n^A^s^-ji/te, u- 

[0011] 

Elite, *mw&mn^&fr&(Di/XT&<DM$:^-? e ^n\t^^(Dn-vr 

)Vuy\i^— $2 0 A^43^T, tflffl (£> Zi > If a. — ^'A^x^iffflL 

, f£3>k°^-^te, ilaz^h2 1t, yXfA^ ; EU2 2t, ->XrA^ 
^U&Mjcd^x^-Aii^-^ h^^o.- y h 2 1 II^itSyXTAA' 
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RAM2 5mn. ROM2 4tCX hT$tlfca*A^/m^^>XT-A (B 

i os) A°-v^^n>tfn.-^ 2 o<dzi>#-*> b (Dm\z.mm*$Km.T 

) >&>6^*tfJU ^^^7,^(C«^jA^;n-K^^X^ H^-f7*2 7 U A— 

K^-f y'2 8 <h> CD-ROMXi»^»i5)^U A-A^l^xV 7 
^ 3 l^g^tBU Ij^W 3 1 tftMfVX^ F5K:/3 0 <h££2 
-g-r^)o A-Fr^X^H7^y2 7, IlT^X^H7'fy2 8 ) ttr 
4 77 F^-ry3 0«, A-F^X^ F^-T^-O^-^jc-X 3 2iSIf 

3 4©f n j ?ntJ:oTyXTA/U2 3 KSic^n&o F^-f^R^n^O 

— ^$tB, ^n^^A^ev 5 ^— a— y±;io >h°^.— ^ 2 o 

3 i zmmT&rtmh. uy\^a.—9\zx^x7y^7s^\mwf~9^7b7 

^-Y^-b'Jy^ RAM, ROMMW,t i b©$^t5. 
[0 0 12] 

1, ROM24, M'RAM2 5{:Xh7^n^§„ yp^^At^a-jKt 
sj-^l/— 5V >^>7^A 3 5t, 1 Xtt-en^±0D77' l J dr— >>a yjuif? 
A3 6£, iC^D^At^a-^STt, ^D^7Af-^3 8t^L 
5£ 0 rL— *ftt, j.— if j J, ^_^_|< 4 0SW>f^ >^t/HX4 2 CD 

ct5^A^^/\*<x^^LTn^>F&^fffB<£A 0 -v^-;i/D>tf3.-^{c:A^ 



* 
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ne>te> ;t7i/^-h, y— k xtt^.— a— tf\n^>u t;w\*t. (us 
b) <D&?fcm i tc^$nTv^ctViffi<z)-r >&—y x.—x&ftisX&titzti'S z> 

-7x-X?:jMTi/XfA/U2 3l:^$n55, KjJOA, /\°-V± 

[0 0 13] 

A-V7 x -;Hl>traL— ^ 2 U^E— h3>t:n.-^4 9<D<fc^lXttf 

®-»^7 h7-7y-KT$.oTJ;K -^nteiM^ncte, A-y^n 
, timmws Ofz\i&mi fcM^bfcc m ^Lfc«iiJTO&^«, n-#;p 

XU7^7^7-7 (LAN) 5 HXU ^7 (WAN) 5 

2£^fr 0 M^^7h7-7StH t7^X, :feil<£>J£tfl&*y h7-7, 

COO 14] 

LAN^y h>7 — #St&K:6EB3ft;fc£#, PC2 0H *y h "7 — ^ -f >^ 
-7x-f7X(j:7W 5 3 ^ITD- t))V*y h7~7 5 1 KJ&ffirr*. -f 
>*—*y h0.t7^WAN^*/ K7-^HT^ffl^n§if, P C 2 0 ttft 
MtfHCte^y h7-7 5 2 iCfcfcoTMSftit^fcftOtrA 5 4Xteflil<£> 
^*S^t§. : EfA5 4H PC 2 0<Z)rtg&Xte^gKlC&oTcl:<, y'J7 
JP#— H-f >^-7i-7 4 6 ^LTy^fA/U 2 3 »Cgg**-r*. *y h «7 
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[0 0 15] 

*lT^-5o 77*1/7 Ml -tn5#*&K£:£€?K:y^E— hn>tfa.— ^#»<?b&i 

L&yryyn— nsn, j ene»^7 > ^-r-7U77 , u ^-yayCctotifT^n 

[0016] 

TK8H$rrs#3;b^J6J&S8Tteu ffl§§ rn>ho— xte rActiveXn> 

^^A©#Jt<Z)7*— AT^fflTSCl^SrfHIEb^^. #58113 tt, r{fjji£n3 
tt, y Xf A U V - X tf^ll 7 ^ t X I fcfd ^ H S>X^A£tS{i 

am&v^ ^ii^aiBifisii^yD^^AT^s. 

[0017] 

Windows95(D«fc-57^^-^l/— >y'yXfA 3 5 te, iiS©7^U ^r— ~>a 
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-T£o yp^7A3 6H ^-r >3 6 i iz^-oxm^n^^^umwrt-y h 2 

1 fcf$M*£ffigS£§{rf£ ZtlZ<k-DT, Jr^V—J-j >^y^fA 3 5 <£>fMT 

(AP I ) U— H 3 5 2 - 3 5 4<D?Uy9%:nX$\&-$'Z\h\Z3L'DXW$£<DA 1 P 
l7T>2z/3>&$£TrrZ>o §APIit 0 1OT^X^W4 7II^7n 

7'u^vV2 1 iz&^xmmm ft Bimtz^z os3sn -jkehc 
> Sfojiiai/fcAPi^^o, ty-x©^ t5 7 ^ u >^ 7^ 7*7 

U (DLL) tVxmn^y^r—^>^^nx^Ki, Microsoft WindowsNT^ 
l^-r-f >^->XrATH Z\nt>(DVLU$, M^^mmz rwin32j itTftl^ 

[0018] 

n&„ ££TfiUH"r£>«l#5£a>Wx86VMX5 I/— ^ 3 9H Tx8 6j "7° 

D-t>7it (8 0386, 80486, ^>tV 7Afc£) miZ&frtltt?' U if ? 
A£rDigital Equipment Corp. CDAlphaRO^IBMcDPowerPCco «fc o f3i7° D-fe y+J-eH 

5->U 7JI/#*t08/912. 454&U*08/904 ( 057t3«t 0 f^KfB® ITfe^o ^eWtC 

^fo^tfr^£x88:7°o-fey1±2 1 IdiiT^ iEtfe-rS^ o^©i$7*n y ? L 
, «-T^)o Wx86VMte, r-tf>^=i-Hj r-9->/7j ) 39 1-39 

3 ^Pf^nS^ya-JUCioTAP I £^rrT<5PgHCWx86£ £*3l&7^\ £ 

b API U —)V&TZ> Z\ <h7^T# 3 <h ^-n b @ 
[0 0 19] 

3 6 2CDJ;5&7-7°l/y h ^HfT^tl^ £ >^-T-7 h V 7 ? V 
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(sandbox) J £UM*l£o 7 7 U y h <D&fr$> * X5n.I/— ^ 3 9 tt> T^U 
7h©3-F$, +f- > H # y 2 X ©JMBJfcJSF&f 3 n > A°-f JW£ nfc* * y > =l 

(sniff) 3— H 3 9 4$+t>r/art}:SAt5. 
[0 0 2 0] 

^tfT^)C0T\ I5al/-^3 9H Act iveXn > h D— ;W$r^ff T ZtcftlZ ( 

S. #JxJi\ AP US^-^lx— >^>X^A 3 5 ^;]/£PWtBT7c#> 
»C, x8 6fiJ9&^ (INT) ^Mt5„ -tftfi^ □ > h JW^ttS 
INTt^te, AP I +f->^ 3 9 1 -3 9 3M7Z73- H 3 9 4 ^/H;Ut 

££J5£L&V>. ^-f >3 6 3T?0it^- ^>n— ;P (CALL) ROT^ — > (RE 
T) , m^/gzifrtfcoij^y-f (JMP/Jxx) <D£5fcm(Dfflm<D$>Z>tii^^ V 

f>3-;n: < koT7^ > 3 6 4 fcfKJjistu ^n^oo^oDt^^o^^ 

~>3 >$nfct#, mz~3>n^ )V2tl*Ln— F©3r*y>'3.tt, 3- 



[0 0 2 1] 

77°l/7 h 3 6 2^e>«AP I n — ;W3:, API n — F 3 5 2 - 3 5 4 djfifMl 
SSn&H. tfb^, it>^n— K 3 9 1-393 tt-ene»*< >^-t7°hb 
» ^n6TM4t5M)lt5. 3 9 lT?©<tofi:^<^<03-;Ht +r>^ 
3 9 1 K<fcoT*h£-r5API 3 5 2 KitgHiSft, £*l e» cdd — Jl/tt, ^X^A 
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9 2 <D v fcmW > 2 *<Dftfe<DU—)V<T>ffi'fe<Dl&WL\Z.Qm\sX. ^tl\Z 

M^T^API353^n-;i/$raT^^:^^^b, ^tl*:kn\z\&~?mzn-)\,* 
Z> Z. ttfX % Z> * 3 9 3 (Dct-5^fe^-tJ->^tt, n-;l/£^n<=>CDAPI354 

^^77>7 h 3 6 2 HcfcoTfF^tlft^o 
[0 0 2 2] 

[0 0 2 3] 

35«U 7,7^^4 1 1 T'l^al/-^ 3 9 &nT$\&-? a v 7° 4 1 2 ~7~7° 
Uy b 3 6 2©n— H^7> hrf £fc#>{C, 01 (DRAM 2 2\Z&\fZ>7 FUX 

%>M*5-X%Z\t.U<. $:3:lzmft'?Z>Z\i:tfX%Z> J *> ? 7&-m\zm 

xtfcZ, gp^D-fe^ U J- 4 mi£$:ftTZ>±X(Dn > h n-;i/^|wi c+j-> H 
^>7^7f7Kt§. t+aiJrr»Oi^-y(DURL (uniform re 
source locator) &^$S<DX\ #t-^>7i7^-yH 'pts. < £ 1 cxD+r 
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[0 0 2 4] 



[0 0 2 5] 

7.5^^4 2 1 U >7£<lx.£7:/l/y MDtWU >7 £-tr>7^o.— 

BP*,, X^rLl/— ^3 9ft 77Vy b 3 6 2 <AP- F|*|-?API3 
52-354lC*rr3£T<7)P--;i/£ji i cHj\ ^tie> ^^T-5+J->^ 3 9 1 - 3 9 3 

7^^7'J> Xte. WindowsT7°U^— ->a >lCckoT^fflT^)il«h^-r-#^)^ 
-^T$)^o JftfWtH DLLte, 1 X«^-n^±©#^OM^^tI#tU> DLL« 

xznzo Dint, mmzm^. m^mxmmr^y )v-^ti^ a -9->^dll 

&^#<ce>API£:/p^U famT&o «AH CreateFile#«fcie>n;fcn$— 

JST £APnczi> Nn-;W^m(CilTo #iJ*_te\ rCreateWindowj % TCreateDia 
logj , rcreatelconj , rCreateCursorJ t>nfcWinnk?\J&ZSmmf£ 

#J*_te\ TCreateProcessj £rfF^-r3 d <h \z£ 0 , f§ jfi-e # & ^ 7 1' y 
HS:+)->H^^^X<D JJ TJ5U © ^ P 7* 7 A £ lift £ d <h # , TEx i t W i nd 
owsExOj ©ck^^^-^l/— ->a >^^^{c^P^^t" SJlt^Tfr, ^-ntcj; 

ot^Jnfca> ho— ;WCX^ — ^n-j !7^m.TZ\iz\Z^-oXk?\^ 
[0 0 2 6] 
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MTo MZ-tt, TSendMessage 0 J teiSS* y-fe— >?£tf>r > FtffcSHrTS. S 
endMessage+l->^^ct Act iveXn > h y-fe— > h P — 

Mz^x±^nrco^f >\zoizmmirz>z}itfx*g2> 0 l frigate*, u-> 
m-r & z. t &ffi ihr z> o 

[0 0 2 7] 

ffi(E>W3:> ^'J££^&J!gmiCfc#M(;:#J0^T-5 fGiobalAllocj , THea 
pCreatej (D<fc-5&Win32API£^0 0 ^n6C0APHzM-r^-ti->^«, *ffcrr3AP 

[0 0 2 8] 

7f7^4 2 2H yfVy Y<DU — H^i2(DX$il/- ^3 9 
$ nfc n— +f- > F # y ^ 7. ©fl-fld fcBBK $ nfc0 4 CD n >/N°-r JPS tifc^- 

[0 0 2 9 ] 

#> fC 7 U y hgf©3-HHfx7^3-H&}fAt-5, rx~7 (sniff 
) o-Fj <hP¥ ttn&ZW^^yZn— Fte, 77lsy h<DU— FtCioT^T 
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7i;l<o 

[0 0 3 0] 

$ttfc'J>^te, 3-MXT7 7°4 3 2^ii:^n7 7$n, 7>f77°4 3 
3T^fT$n, 7xf7 7 1 4 3 4 7?I(liI§n, 7*U y ? £ tlXteSf "I 

[0 0 3 1 ] 

> Xf7 7°4 3 5llJ:oT, tfrH^^e (D It > F#y ^Xf*J<£>7 F l/7>^#It§ 

«\ xr7 7 t 4 3 7(i ^) 7 t uyx^^^m-ynm^^n^Eot^m't 
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4 3 8(i7^tX^^D7^l, x^-^M-To 7^73-Httun^07f7 
7°£fltfT£o ftf!CDX86ifrfrH X f 7° 4 3 6 C i; o Tit g^lff $ tl § . 

^r©^, n>hn-M7f>y^4 3 l(ii^„ 7DtX4 0 0H ^7h77 
[0 0 3 2] 

lKO^©y7TATft 4 3 3(Z)J;f>^yP^^{CctoTAPI(D||ff^\ 

>^-rr$>^^e»«\ It^^APn^LT^n^X^E U con >"r>y 

^$n^^tuc7)n>7 : ->^^^Mb, ^ntc^oTAPiKMLTM^c^nfc 

3 3-lH m(D^m<D r^^-yntf- (deep copy) J £HtfU ^n^^ 

4 3 3-2H API^^cDMDffi^^^-yntf-T^o JE^NfS'JK, Xry? 
4 3 3/^API£HfTT£<hi^ 7f^74 3 3-lH APl7^HR§UC=3-;|/£n& 

, APHlii$nfc^Tc7)5lic^*^lcn bf--T-&o TZfUy F g # d <£> tr- 
ie 7 £ <h^T#&^c7)-t;\ APIte, IS^#£nW35r-^£:tt£ 

, APIn>#-^> F^Hfrb/i^ XT7^4 3 3-2H T^Vv hc7)^ffl 
[0 0 3 3] 

^'^^5. ^a6fiJDST£>nfciBH2 5 1 «, it>H!K'y^X&fl$t5. 
-en«, 77'U7h 3 6 2 t, T~?Vy h<DHff *lc:, 7HI/XPlife7-+> 
^'X F v ? tCg8-r<5^>^-f A^^E'Jir^^ >h 2 5 2i, gg^D- F+J">£ 
3 9 1 - 3 9 3 (CCT1W>7391tl/T^t) £X h7t £fc#><7)-fe 
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7^^2 5 1©ni©^ : E l J2 2H Z\Z\T°\$3 5 2 tCcfco T*£*l£ A P I 
DLLt, #-*;]/32 3 5 5 tS^TS. fdl tf) 7 - ^ > ^ U 3 56 

i 5(7)^ij(cgBB$n^>o t^aijf^u v— a^KfcHfr $n5i^n 

tfeSWT, ^>Fl7i'X2 1 5(D^#JCDWHKRNL32 3 2 5 (DliKte, ^tlg 
CO 0 3 4] 

8 6Win32T^U!y h £Hff T£fc&Oi!uj7!i<Z>Wx86VMxa n * U Win 
dows95XHWindowsNT^-^U— 5V >^yXfATTx 8 6 ^7 7 h 7*-AT 

[0 0 3 5] 

>&—*y h#><bA— H ^<Dc:¥temp¥foo. ocxlc, foo. ocx£B* tftiSActi 
veXn>hP — ;i/ (Tyi/^h) 4^>n-Kt5. JfcSl^. ocxteAct iveXP > 

[0 0 3 6] 

W$R<£*I^U u-HSnMf3>ha-MS*tS. Wx86VMp>^-^> 

-r>^— hi^^^a-7^Miib, wx86VM(c^n^iiDm"r 

[0 0 3 7] 

n > h P -;i/^tWx86VMX 5 =l U-?{Z&^Tm 9 tB Stl5^ £ fc£> Wx86VM 
^^^eUOfiJO^Tbtlfc^. XteU ActiveXP>hP-;U{;:MT<5+J->Ktf 
^ ^X£3eJ5£T£o Wx86VM«, ActiveXn> ho-jP (0 4ttt3 6 2 ^t) f 
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oo. ocx£+J-> Ftf^ ^XfttCD — KT-5. 
[0 0 3 8] 

Wx86VMte> 3 9 l<D«fc5fcAPIU->#DLL (2c£API) £+J-> Katfy ^Xl*)K:n 
-FT*. Wx86VMte, Mifli<Z>tM ( H^ry h777. 016US1) K&^T-KHcl^b 

d © £ £ «fc D , Wx86VMte, M^£PWttJ«lCjgl^£ijx^ x8 
6-f ;* - v t *^coAP 1 1 <D m t'it > £ n - H AT £ CI t #T # § . HIEMT 
Ztc&XD&mW X hte, h 'J KIT, h7$n§. ^JxJf, *-^32 ( 

0 4Ttt3 5 5) tt, (0 4W>^ 3 9 1 £^T) wikrnl32KI?gEfi£n> 
user32. dlltewiuser32. dlltc?liB«$n«). h?W>?iZX<D 2 o ©DLL;^ S> fit/& 
$n-S : loll Wx86VMftTf£«!rr& Twij £V>5&^8*#tt^;fcDLLTi&9, 
^■&fcMtfBtej&«&<, ffi©t>£^teWx86VM<©^fl!lTf&«U Twhj tV^SffiSf 

[0 0 3 9] 

Twij DLLte> ^E-n^^aaiTSfciexD^WDLLtbTI^Dx^X^— 
PWffiU itittlt. -^©APIkHSIbT-fe^U^ ^'J £HfrT5. f# 

o tbopj tn?«nsc:<0 3— nswtn t-H^-Y^f^^sc^ 

^Si:-rsWx86. dll£^llT34g5cJjfcx86 opcodeT&S. B0Pnv>Kte, 7* 
-A rBOP (DLL#, API #) J &m-tZ>. Wx86VM^\ m^ifiVy 2 7.<DV~J7,2 
±y bRlfi7s9v9\z7l7li7>T2>s (BI4T«whkrnl32 3 5 2 (D&5te) r w h 
J £^o1£m&-V&Z>fc7s MM H^>^DLL^B0P^T-V7<A o ^^-r^ tfT, DL 

PI©3lffc£tttU 1t> F^^^XCOEAXI/vX^lCRDffl^H 

[0 0 4 0] 

^JAU x8 67^I/7hX(i3>hn-M kernel32!CreateFilefc:2fr 
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58£WfcU >££*rf Wx86VMte-€-<Z)'J>#£, wikrnl32 ICreateFi le 

7^1/7 h^CreateFile^Pf tftbt*£#. wikrnl32!CreateFi lete 
, +>•> K#y^7^e>*-f5V ytdX-T ^/^-rSBOP^SrUfT U Wx86IDispat 
chBopO SrWx86VMI.dll^P?rJCHj-ro Wx86DispatchBop 0 tt, 3-;i/£whkrnl32!wh 
CreateFileO Cr^X/Vym. -eoPIISfctt, ^r^f :/kernel32 ICreateFi 1 

o 

[0 0 4 1 ] 

Wx86VMte*fc, 3 9 n- HWx86cpu.dll &o-h't-5. 7^Uy 

o 

[0 0 4 2] 

0HAfc£* 7~?Vv Moo. ocx#ffe<frMOV EAX, [ESI +4] feQ^-TSfeS 

MOV EAX, [ESI +4] 

LEA ECX, [ESI +4] 
CALL SNIFFREAD4. ECX 
MOV EAX, [ECX] 

[0 0 4 3] 
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Moo. ocx^T^^^r^-r-S^^tt*, 
MOV EAX, [ESI +4] 
MOV EDX, [ESI +8] 

LEA EAX, [ESI +4] 
CALL SNIFFREAD8. ECX 
MOV EAX, [ECX] 
MOV EDX, [ESI +4] 

LEA EAX, [ESI +4] 
CALL SNIFFREAD4. ECX 
MOV EAX, [ECX] 
LEA EAX, [ESI +4] 
CALL SNIFFREAD4. ECX 
MOV EDX, [ECX] 

[01] 

[0 2] 
[0 3] 
[04] 



« <r 



I 




2001-51441 



P2001-514411A) 



13 




CM 

.1 




CM 
CM 










VI 
























On 
IKVH 

ilxmr\ 

m-j- j 






r<vv 


vr> h 

iKvr\ 
*-t-ir\ i 




i 





8 



CO 
CM 

4 



CM 







o 



00 j 



to 



in 



m* 

^ I 

□IK 



am i 



IKK 
I 

Jsrvih 



- 26 - 




- 27 - 




l&m. 2001-51441 WP 2001-51441 1 A) 



# 



400 



410 



41 W X5aL/-^Sa-K^S I 

A 

412^ t^v^^^^Siiio^-cs I 



T 



413H Tzfisy h«a-^g-« | 420 



421- 



I 



u^iiiti I 

423 SNFFD - K 




FIG. 3 



- 28 - 




1*S 2001-51441 WP 2001-514411 A) 



# 



4] 



25 
_1_ 



215 

__s 



FOO.OCX 



391- 



W1KRNL32 



WHKRNL32 




FIG. 4 



- 29 - 




001-51441 




2001-514411 A) 



1=1 J 



INTERNATIONAL SEARCH REPORT 



tnt tfonai Application no 

PCT/US 98/17553 



A. C LASS ff 1 (CATION OF SUBJECT MATTER 

IPC 6 G06F1/00 



AccoKltrtg io tntamattonat Pmn QtasiHfcaiivn (iPCl or <o both natbna) cta*s«teailon ana IPC 



B. FELOS SEARCHED 



MJotntum documentation searched (dasmncoiron system fo Bowed by cfawiicatton ayrroota) 

IPC 6 G06F 



OocumanUibn searched other than irtnraim documentation to tha extent that such documents are included in the ftefcb searched 



Bectrortfc data bast* consulted during tha Wernatboai search (name of data bass and, wham practical, search tarrna used) 



C DOCUMEfiTS COKSIQcPtEO TO BE RELEVANT 



Category 



Clarion of document with indication, wham appropriate, of the re! evert paseaoea 



ReJovarrt to claim No. 



ESAFE TECHNOLOGIES INC.: "New Antf-Vandal 
Software Provides 'Next Generation* PC 
Protection" 

28 April L997 , SAN DIEGO, US, XP002086033 
Available from Internet;<URL: 
http : //www . es af e . com/ pres s/pr032997 . html > 
see the whole document 

EP 0 667 572 A (IBM) 16 August 1995 

see the whole document 

W0 94 07204 A (UNILOC CQRP PTY LIMITED 
;RICHAR0SON RIC BAILIER (AU); UNILOC 
SINGA) 31 March 1994 
see the whole document 



1,8,11, 
13,15 



1,8,11, 
13,15 



1,6-8,16 



[ Xj F«rthar dooumara*. an* fated In the continuation of box C. 



Patent to (nify members are fstatf in annax. 



* Special caregoriee of cfted documents : 

'A 0 do current defining tha general date of the artwhfch to not 
oonaMered to be ot particular relevance 

"E" earth* docurnent but pubfebed on ot after tha International 
Filing data 

•L" document which may throw doubts on priority ctaimfsior 
which is clea to estattlab the publication data or another 
crtoaofi or other apodal reason (as specified) 

*0° document referring to an ereJ dJaeknurw, use, exhbftionor 
other means 

*P" dbeumarapubliBtod prior to tha international fling data but 
later than the priority dale darned 



T later document pubtbhad after the reemarjoneJ ffflng dote 
or prtorty date end not In oorrflct with the apptcauon but 
ctod to understand tna prtnetote 01 theory undaitylng tha 
Invention 

"X" document o< particular relevance; the cbimed invention 
cannot be considered novel or cannot be considered] to 
involve an tnvemtve stop when the aocumert to taKen atone 

■V" document ol particular ro torero©: the claimed invention 

cannot be coneklered to Involve an Inventive step when the 
document to combined with one or more other auch docu- 
ment*, such cDcnomaoon being obvious to a person anted 
m the art 

dooumant member of the earae patent earnfty 



Date of the actual completion of the ertemationat aeojeh 

27 November 1998 


Dale of milling of the international search report 

08/12/1998 


Name and mailing address of the t6A 

European Patent Office. P.B. 5818 Patent tan 2 
ML - 2280 HV Rijftwiik 
Tel (^31-70) 340-2040, Tr. 31 CSI epo nt. 
Fax: (+31-70) 34O3016 


Authorized officer 

Powell , 0 



Form PCTA8A/210 <M»©r»d«h«»0(vMy 1*82) 



page 1 of 2 



- 30 - 




&m 2001-51441 WP 2001-51441 1 A) 



INTERNATIONAL SEARCH REPORT 



InU lonol Application No 

PCT/US 98/17553 



C<Caneino«tlo*» DOCUMENTS CONSJOEREQ TO BE RELEVANT 



C lotion of document wltr» rKflcat/on,*rti«r» appropriate, c< Vys r»»«vart passage* 



H«tev«nl lo claim No. 



1 



HAMILTON M A: "JAVA AND THE SHIFT TO 

NET-CENTRIC COMPUTING' 

COMPUTER, 

vol. 29, no. 8, August 1996, pages 31-39, 

XP000632765 

see page 31, paraaraph 4 
see page 34, left-hand column, paragraph A 
- right-hand column, last paragraph 
see page 36, left-hand column, paragraph I 
right-hand column, paragraph 1 

EP 0 646 865 A (BULL HN INFORMATION SYST) 
5 April 1995 

see abstract; figures 1,25-8 
see page 6, line 46 - line 51 
see page 21, line 32 - line 46 



2,9,14, 
15 



Forni PCT1SA/S10 (06fttfouMioAc(c4GAnd£ftMt) (JuV 19821 



page 2 of 2 



- 31 - 




2001-51441 



2001-514411 A) 



INTERNATIONAL SEARCH REPORT 

inTomrnnon on patent family members 



Patent document 
cited in search report 



Publication 
date 



tnt*. Jorwrf A pp(1 cation No 

PCT/US 98/17553 



Patent lamsy 
members) 



Pubflcauon 
dais 



EP 0667572 



16-08-1995 



OP 7230380 A 
US 5673315 A 



29- 08-1995 

30- 09-1997 



WO 9407204 



31-03-1994 



At) 678985 B 

AU 4811393 A 

CA 2145068 A 

CN 1103186 A 

EP 0689697 A 

NZ 255971 A 

US 5490216 A 



EP 0646865 



05-04-1995 



AU 679775 6 

AU 7428994 A 

CA 2132900 A 

JP 7182180 A 

US 5572711 A 

US 5675771 A 

US 5566326 A 

US 5664098 A 



19-06- 
12-04- 
31-03- 
3 1-05- 
03-01- 
26-05- 
06-02- 



1997 
1994 
1994 
1995 
1996 
1997 
1996 



10-07- 
13-04- 
29-03- 
21-07- 
05-11- 
07-10- 
15-10- 
02-09- 



1997 
•1995 
•1995 
•1995 
1996 
1997 
1996 
1997 



Fonti PCTflSA/210 (pabrt Urafy anno*} (Jutyi«21 



- 32 - 



7n> h^\~iS(Dm^ 



7y>h>ffl 98008 

7^xf^7^7x :/v-fx /— x-f 

-X h 3272 
F^-A(##) 5B017 AA07 BA06 BB06 CA01 

5B076 FD00 



